Add guardian approval MVP by charley-oai · Pull Request #13692 · openai/codex

charley-oai · 2026-03-06T06:13:22Z

Summary

add the guardian reviewer flow for on-request approvals in command, patch, sandbox-retry, and managed-network approval paths
keep guardian behind features.guardian_approval instead of exposing a public approval_policy = guardian mode
route ordinary OnRequest approvals to the guardian subagent when the feature is enabled, without changing the public approval-mode surface

Public model

public approval modes stay unchanged
guardian is enabled via features.guardian_approval
when that feature is on, approval_policy = on-request keeps the same approval boundaries but sends those approval requests to the guardian reviewer instead of the user
/experimental only persists the feature flag; it does not rewrite approval_policy
CLI and app-server no longer expose a separate guardian approval mode in this PR

Guardian reviewer

the reviewer runs as a normal subagent and reuses the existing subagent/thread machinery
it is locked to a read-only sandbox and approval_policy = never
it does not inherit user/project exec-policy rules
it prefers gpt-5.4 when the current provider exposes it, otherwise falls back to the parent turn's active model
it fail-closes on timeout, startup failure, malformed output, or any other review error
it currently auto-approves only when risk_score < 80

Review context and policy

guardian mirrors OnRequest approval semantics rather than introducing a separate approval policy
explicit require_escalated requests follow the same approval surface as OnRequest; the difference is only who reviews them
managed-network allowlist misses that enter the approval flow are also reviewed by guardian
the review prompt includes bounded recent transcript history plus recent tool call/result evidence
transcript entries and planned-action strings are truncated with explicit <guardian_truncated ... /> markers so large payloads stay bounded
apply-patch reviews include the full patch content (without duplicating the structured changes payload)
the guardian request layout is snapshot-tested using the same model-visible Responses request formatter used elsewhere in core

Guardian network behavior

the guardian subagent inherits the parent session's managed-network allowlist when one exists, so it can use the same approved network surface while reviewing
exact session-scoped network approvals are copied into the guardian session with protocol/port scope preserved
those copied approvals are now seeded before the guardian's first turn is submitted, so inherited approvals are available during any immediate review-time checks

Out of scope / follow-ups

the sandbox-permission validation split was pulled into a separate PR and is not part of this diff
a future follow-up can enable serde_json preserve-order in codex-core and then simplify the guardian action rendering further

charley-oai · 2026-03-06T06:15:51Z

@codex review this

Co-authored-by: Codex <noreply@openai.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e4d044c3cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/tools/network_approval.rs

codex-rs/core/src/tools/handlers/unified_exec.rs

Co-authored-by: Codex <noreply@openai.com>

charley-oai · 2026-03-06T07:45:02Z

Rebased this branch on top of #13703. That precursor PR isolates the helper semantics so the guardian-specific behavior change can be reviewed separately.

charley-oai · 2026-03-06T07:45:07Z

Rebased this branch on top of #13703. That precursor PR isolates the SandboxPermissions helper semantics so the guardian-specific behavior change can be reviewed separately.

Co-authored-by: Codex <noreply@openai.com>

charley-oai · 2026-03-06T20:55:22Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1904fe78ec

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/app-server-protocol/src/protocol/v2.rs

codex-rs/core/src/guardian.rs

Co-authored-by: Codex <noreply@openai.com>

charley-oai · 2026-03-06T22:40:53Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5846ca060f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/tui/src/app.rs

codex-rs/core/src/tools/sandboxing.rs

charley-oai · 2026-03-06T22:59:17Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7fdebc4f49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/tools/handlers/shell.rs

codex-rs/protocol/src/protocol.rs

charley-oai · 2026-03-06T23:24:34Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fd70f82592

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/tools/handlers/shell.rs

charley-oai · 2026-03-07T01:07:40Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

codex/codex-rs/core/src/tools/orchestrator.rs

Lines 242 to 243 in 364c4dd

    
           matches!(approval_policy, AskForApproval::OnRequest) 
        
               && network_approval_context.is_some()

Allow guardian network retries after sandbox denial

allow_on_request_network_prompt only checks AskForApproval::OnRequest. In guardian mode, a sandbox-denied command with network_policy_decision is returned immediately instead of entering the approval/retry flow, so the guardian never reviews managed-network escalation. This breaks the stated "guardian mirrors OnRequest" behavior for blocked network access.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

dylan-hurd-oai

Some non-blocking comments - overall this feels pretty reasonable. Excited to try it out!

codex-rs/core/src/tools/handlers/mod.rs

codex-rs/core/src/tools/handlers/shell.rs

codex-rs/core/src/tools/sandboxing.rs

codex-rs/core/src/codex_tests.rs

codex-rs/core/src/guardian.rs

Co-authored-by: Codex <noreply@openai.com>

charley-oai · 2026-03-07T13:16:36Z

@codex review this

charley-oai · 2026-03-07T13:22:52Z

@codex review this

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 125a5ea57c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

codex-rs/core/src/mcp_tool_call.rs

Co-authored-by: Codex <noreply@openai.com>

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

afa63ec

Co-authored-by: Codex <noreply@openai.com>

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

codex-rs/core/src/tools/network_approval.rs Outdated Show resolved Hide resolved

codex-rs/core/src/tools/handlers/unified_exec.rs Outdated Show resolved Hide resolved

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

5d8932a

Co-authored-by: Codex <noreply@openai.com>

charley-oai force-pushed the guardian-approval-mvp branch from 6ca9bfc to 09f53a1 Compare March 6, 2026 07:44

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

200fe4f

Co-authored-by: Codex <noreply@openai.com>

charley-oai force-pushed the guardian-approval-mvp branch from ce8dbdd to 4bb939f Compare March 6, 2026 08:32

charley-oai changed the base branch from main to clarify-sandbox-permission-semantics March 6, 2026 09:16

Base automatically changed from clarify-sandbox-permission-semantics to main March 6, 2026 17:57

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

eff0f56

Co-authored-by: Codex <noreply@openai.com>

charley-oai force-pushed the guardian-approval-mvp branch from dc00757 to d70e046 Compare March 6, 2026 18:03

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

50b63b8

Co-authored-by: Codex <noreply@openai.com>

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

codex-rs/app-server-protocol/src/protocol/v2.rs Outdated Show resolved Hide resolved

codex-rs/core/src/guardian.rs Outdated Show resolved Hide resolved

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

27752c5

Co-authored-by: Codex <noreply@openai.com>

charley-oai added a commit that referenced this pull request Mar 6, 2026

codex: fix CI failure on PR #13692

fe7fc07

Co-authored-by: Codex <noreply@openai.com>

charley-oai force-pushed the guardian-approval-mvp branch from 2f6c83d to 282a21a Compare March 6, 2026 21:11

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

codex-rs/tui/src/app.rs Outdated Show resolved Hide resolved

codex-rs/core/src/tools/sandboxing.rs Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

codex-rs/core/src/tools/handlers/shell.rs Show resolved Hide resolved

codex-rs/protocol/src/protocol.rs Outdated Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Mar 6, 2026

View reviewed changes

codex-rs/core/src/tools/handlers/shell.rs Show resolved Hide resolved

chatgpt-codex-connector bot reviewed Mar 7, 2026

View reviewed changes

dylan-hurd-oai approved these changes Mar 7, 2026

View reviewed changes

pakrym-oai reviewed Mar 7, 2026

View reviewed changes

codex-rs/core/src/guardian.rs Show resolved Hide resolved

github-actions bot mentioned this pull request Mar 7, 2026

📊 AI CLI 工具社区动态日报 2026-03-07 rollysys/agents-radar#47

Open

charley-oai and others added 20 commits March 7, 2026 05:15

restore codex context block ordering

6c1f53c

Co-authored-by: Codex <noreply@openai.com>

rely on normal guardian permissions instructions

09ede4f

Co-authored-by: Codex <noreply@openai.com>

remove duplicated guardian parent context block

673b451

Co-authored-by: Codex <noreply@openai.com>

simplify guardian review flow

5e5d7e1

Co-authored-by: Codex <noreply@openai.com>

improve guardian request prompt framing

659b99d

Co-authored-by: Codex <noreply@openai.com>

simplify guardian review plumbing

64f9cf0

Co-authored-by: Codex <noreply@openai.com>

split guardian transcript snapshot items

f922763

Co-authored-by: Codex <noreply@openai.com>

tighten guardian prompt layout

a39d250

Co-authored-by: Codex <noreply@openai.com>

clarify guardian approval request prompt

a9ec969

Co-authored-by: Codex <noreply@openai.com>

tweak guardian transcript framing

8c45a58

Co-authored-by: Codex <noreply@openai.com>

clarify guardian output contract

cb57ff4

Co-authored-by: Codex <noreply@openai.com>

polish guardian prompt labels

f74ea98

Co-authored-by: Codex <noreply@openai.com>

clarify guardian entry token budgets

b7656fd

Co-authored-by: Codex <noreply@openai.com>

use constant in guardian model comment

807c813

Co-authored-by: Codex <noreply@openai.com>

polish guardian naming nits

5287239

Co-authored-by: Codex <noreply@openai.com>

seed guardian approvals before first turn

645e6f9

Co-authored-by: Codex <noreply@openai.com>

forward guardian patch retry reason

21656e6

Co-authored-by: Codex <noreply@openai.com>

fix guardian test drift

726eb78

Co-authored-by: Codex <noreply@openai.com>

rerun guardian snapshot CI

46ea76f

Co-authored-by: Codex <noreply@openai.com>

route mcp approvals through guardian

125a5ea

Co-authored-by: Codex <noreply@openai.com>

charley-oai force-pushed the guardian-approval-mvp branch from b33441a to 125a5ea Compare March 7, 2026 13:16

charley-oai enabled auto-merge (squash) March 7, 2026 13:19

chatgpt-codex-connector bot reviewed Mar 7, 2026

View reviewed changes

codex-rs/core/src/mcp_tool_call.rs Show resolved Hide resolved

rerun guardian snapshot CI

b37d322

Co-authored-by: Codex <noreply@openai.com>

charley-oai disabled auto-merge March 7, 2026 13:39

charley-oai merged commit e84ee33 into main Mar 7, 2026
21 of 30 checks passed

charley-oai deleted the guardian-approval-mvp branch March 7, 2026 13:40

github-actions bot locked and limited conversation to collaborators Mar 7, 2026

	matches!(approval_policy, AskForApproval::OnRequest)
	&& network_approval_context.is_some()

Conversation

charley-oai commented Mar 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Public model

Guardian reviewer

Review context and policy

Guardian network behavior

Out of scope / follow-ups

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

charley-oai commented Mar 6, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

charley-oai commented Mar 7, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

dylan-hurd-oai left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

charley-oai commented Mar 7, 2026

Uh oh!

charley-oai commented Mar 7, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

charley-oai commented Mar 6, 2026 •

edited

Loading